C2 Beacon With Jitter: Find It in a PCAP
Threat intelligence shared a tip: a commodity implant seen this month calls home over HTTPS every few minutes with a randomised delay. You have three hours of egress traffic from a small office segment (10.60.12.0/24), captured on the inside of the firewall.
Nothing here is decrypted: you only have TLS handshakes, server names and record sizes, which is what most network sensors see. Find out whether any host is beaconing, to where, how regularly, and whether it ever received instructions. Everything in this file is synthetic: documentation IP ranges, .example names and random bytes in place of encrypted data.
What you will find in the capture
- Three workstations browsing several HTTPS sites at irregular times
- One destination contacted again and again with almost identical, small sessions
- One of those sessions where the server sent much more than usual
C2 Beacon With Jitter: Find It in a PCAP
Threat intelligence shared a tip: a commodity implant seen this month calls home over HTTPS every few minutes with a randomised delay. You have three hours of egress traffic from a small office segment (10.60.12.0/24), captured on the inside of the firewall.
Nothing here is decrypted: you only have TLS handshakes, server names and record sizes, which is what most network sensors see. Find out whether any host is beaconing, to where, how regularly, and whether it ever received instructions. Everything in this file is synthetic: documentation IP ranges, .example names and random bytes in place of encrypted data.
You will practise
- Use TLS ClientHello server names (SNI) to see where encrypted traffic goes
- Separate machine-timed connections from bursty human browsing
- Measure a beacon’s average interval and the spread that jitter adds
- Use record sizes to spot the one session that carried more than a check-in
- Decide the containment and the hunt that follow a beacon finding
8 questions. Each hint costs 25% of that question’s points; a wrong try costs a little. Your score is out of 100.
Loading the capture…
Loading…
Sample report · illustrative data
Sample result: Cleartext HTTP Login case
Example run of the starter case on a synthetic capture (documentation and private IP ranges, .example names, a made-up account).
Scoring
- Score
- 82/100 (example)
- Grade
- B, solid analysis
- Hints used
- 2 (example)
- Time
- 6m 40s (example)
Findings in the example run
| Question | Filter that finds it | Read |
|---|---|---|
| Where is the login submitted? | http.request.method == "POST" | One POST to the intranet over port 80 |
| What crossed the wire? | http.file_data contains "username=" | Username and password readable as typed |
| Did it work? | http.response.code == 302 | Redirect plus a session cookie without Secure |
Recommended next steps (example)
- Serve the intranet over HTTPS only, with HSTS and Secure cookies
- Reset the exposed password and end the account's sessions
- Search wider captures for other cleartext logins
Made-up example data. Your own run uses your inputs. Downloads of the full report need Pro.
Downloads
Take the capture into Wireshark or your own tools, and keep the analyst report with the answer key.
399.4 kB · 2117 packets · SHA-256 51129e36d9a35d3d6e8081a56b52334183b540031f49f52510ca910d1333761a
Sample of the debrief
This capture shows command-and-control beaconing hidden in ordinary HTTPS. One workstation looks up the same name and opens a short TLS session to the same address every few minutes, with a randomised delay, while the people in the office browse normally around it.
The full debrief, with next steps and the MITRE ATT&CK mapping, appears when you finish the case.
What you will learn
- Use TLS ClientHello server names (SNI) to see where encrypted traffic goes
- Separate machine-timed connections from bursty human browsing
- Measure a beacon’s average interval and the spread that jitter adds
- Use record sizes to spot the one session that carried more than a check-in
- Decide the containment and the hunt that follow a beacon finding
Frequently asked questions
How do you find C2 beaconing in a PCAP?
Group connections by source and destination and look at their timing and size. A beacon shows as many small, similar sessions to one destination at a steady average interval. In Wireshark, filter one destination or TLS server name and read the times between ClientHellos.
What is jitter in a C2 beacon?
A random variation added to the sleep time between check-ins, for example 300 seconds ±20%. It defeats rules that look for an exact period, but the average interval and the regularity still show over many check-ins.
Can you detect C2 over HTTPS without decrypting it?
Often, yes. The TLS server name, the destination, the timing and the record sizes are all visible. Regular timing, near-identical sizes and a destination nobody else uses are strong signals even with the content encrypted.
How do you calculate a beacon interval from a capture?
Filter one packet per beacon (such as the ClientHello), take the time of the last minus the first, and divide by the number of beacons minus one. The smallest and largest single gaps show the jitter.
Is this real malware traffic?
No. PlayCISO generated it from a fixed seed with documentation IP ranges and .example names. The TLS records are random bytes shaped like TLS, not traffic from a real implant or C2 framework.